fd36e4ef40c0091e1eacd6c63861617f3476f6f04d217500f743c211c7b0b0e3 | Triage

Sharing

General

Target

fd36e4ef40c0091e1eacd6c63861617f3476f6f04d217500f743c211c7b0b0e3
Size

116KB
Sample

221030-frda6aecfn
MD5

a288466018cee60591577b50f8c23070
SHA1

5952e02a89ab352fd4e5c1d7be04bc65a1966119
SHA256

fd36e4ef40c0091e1eacd6c63861617f3476f6f04d217500f743c211c7b0b0e3
SHA512

9f2b24b7b9e93e117a73461f49a7a2919c41fff00bc62460a9ba5a13a4f424be958c70d3c23b3ae2b068c4f0d0255a0dc82ec66bc441ea1db6c5836fa0834421
SSDEEP

1536:w1pxoa++tv8Kw6KBOIW4Z8HO1Zwt0f4HeDUEdMOPy9sbgNLwo7JaSi:wp6+tvfIr1ZNDUEdawQU

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  fd36e4ef40c0091e1eacd6c63861617f3476f6f04d217500f743c211c7b0b0e3
- Size
  
  116KB
- MD5
  
  a288466018cee60591577b50f8c23070
- SHA1
  
  5952e02a89ab352fd4e5c1d7be04bc65a1966119
- SHA256
  
  fd36e4ef40c0091e1eacd6c63861617f3476f6f04d217500f743c211c7b0b0e3
- SHA512
  
  9f2b24b7b9e93e117a73461f49a7a2919c41fff00bc62460a9ba5a13a4f424be958c70d3c23b3ae2b068c4f0d0255a0dc82ec66bc441ea1db6c5836fa0834421
- SSDEEP
  
  1536:w1pxoa++tv8Kw6KBOIW4Z8HO1Zwt0f4HeDUEdMOPy9sbgNLwo7JaSi:wp6+tvfIr1ZNDUEdawQU
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence